On FortiGate, the quarantine daemon (quarantined, also referred to as quard) is the process responsible for communication with FortiSandbox: it queues suspicious files, submits them for inline analysis, and receives the verdicts that FortiSandbox returns. Monitoring this daemon in real time with diagnose debug application quarantine -1 (and testing it with diagnose test application quarantined) shows file submissions and returned verdicts, which confirms that FortiGate is receiving results from FortiSandbox. The wad daemon handles proxy-mode traffic processing, scanunitd performs local antivirus scanning, and FortiGate has no fsd daemon responsible for FortiSandbox verdicts.
Community Discussion